Refitter CVE-2026-63344

Requires an attacker-controlled or attacker-influenced OpenAPI description whose requestBody/responses content map contains a crafted content-type KEY (e.g. 'application/<breakout>') embedding quotation marks to break out of the generated Refit [Headers("Accept: <ct>", "Content-Type: <ct>")] attribute. The affected product is Refitter <= 2.0.0; the malicious key survives Refitter's DEFAULT OpenAPI validation, so --skip-validation is NOT required. Exploitation is gated by developer/build-time action (UI:A): a victim must run Refitter on the hostile spec and compile the generated client into an application; code then runs automatically at assembly load via [ModuleInitializer] with no call to the client. Limiting factors: the spec must be attacker-influenced (not an issue for fully trusted internal specs), the victim must generate and build the client, and upgrading to 2.1.2 (which escapes the characters and adds AttributeStringValidator) closes it. Verified on Refitter 2.0.0 and .NET 8.

This is a CWE-94/CWE-116 code-injection flaw in Refitter (a C

Refit client generator) rated CVSS 4.0 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H). The high score is driven by full confidentiality/integrity/availability impact from arbitrary code execution, with no authentication (PR:N) and low complexity (AC:L). The critical tempering signal is UI:A: exploitation is not a remote drive-by - it requires a developer to take an attacker-influenced OpenAPI description, run Refitter against it (default validation, no --skip-validation needed), and compile the result; the injected [ModuleInitializer] then runs at assembly load without any call to the client. The vuln.today Decision label is 'this_week', consistent with a serious but not emergency finding. No EPSS score and no KEV listing are present in the provided data, and there is no indication of active exploitation, so this is 'no public exploit identified as confirmed' though PoC scripts (reproduce.sh, make_spec.py) are referenced by the advisory. Net: a genuine high-priority issue specifically for teams that generate Refit clients from third-party or otherwise untrusted/attacker-influenced OpenAPI specs; materially lower real-world risk for teams generating only from trusted, internally-controlled specifications. Note one conflict: the embedded GHSA package metadata says 'not yet patched', while the advisory description and the 2.1.2 release tag state the fix shipped in 2.1.2 - treat 2.1.2 as the fixed version.

An attacker crafts or influences an OpenAPI description so that a content-type key in a requestBody/responses content map contains quote/breakout characters. A developer generates a Refit client with Refitter (<= 2.0.0) under default validation and compiles it into an application; the crafted key breaks out of the [Headers("Accept: ...", "Content-Type: ...")] attribute and injects a top-level file class with a [ModuleInitializer] method, so attacker code executes at assembly load during application startup - even though application code never calls the generated client. A public PoC reference exists (reproduce.sh + make_spec.py); it is not verified as working exploit code in the provided data.